#!/bin/bash 

echo '**********************************************************************'>/etc/motd
echo '*|  Time  |      Up Time     |Loing Users|        Load Average        |'>>/etc/motd
w |grep 'load average'>> /etc/motd
echo '**********************************************************************'>>/etc/motd
#cat /home/cc/dgh/notes>>/etc/motd
#cat /etc/motd-local >> /etc/motd
# 
PATH=/sbin:/bin:/usr/sbin:/usr/bin
LOG_FILE=/var/log/secure
KEY_WORD="authentication failure"
PERM_LIST=/root/bin/bad.list.perm
LIMIT=15
MAIL_TO=
#tail -800 $LOG_FILE | grep -i "$KEY_WORD" |awk '{print $13}' > /root/bin/Failed.list
tail -500 $LOG_FILE | grep  "$KEY_WORD" |grep -v 202.122.36.24 |cut -d\=  -f7|cut -d\  -f1 > /root/bin/Failed.list
tail -100 /root/bin/Failed.list | sort -ur |
{
    while read ip
    do
      n=`grep $ip /root/bin/Failed.list | /usr/bin/wc -l`
      if ( t=`expr $n \> $LIMIT` )
      then
        ipt=`iptables -L INPUT -n|grep "$ip"`
        if [ "$ipt" == "" ];then
          iptables -I INPUT -s $ip -j DROP
          echo "$ip" >> /root/bin/deny.ip
        fi
      fi
    done
}

exit
